Basecamp Export

Ryan Knuth, Customer Support Manager

Hi all,

Please find attached the most recent scan. I suggest we delete or mark complete previous to-dos within this list as this scan will now supersede those issues.

Jitesh

Please review the results, and let us know if you have any questions. I've attached the report in HTML as well.

Once you're comfortable with the results I can create separate to-dos for each vulnerability.

Thanks!

Ryan

May 01, 2019 at 8:58 PM Notified 3 people

Morgan Maguire, CEO

Thanks

Ryan

.

I've completed all the old to-do.

Jitesh

, let us know which issues raised in the scan are critical (i.e., should be addressed immediately in the current), and which issues can be left to be dealt with in the new application.

Thanks,

Morgan

May 01, 2019 at 9:16 PM Notified 3 people

Jitesh Dhuravala

Hi

Morgan

,

I have check ZAP Scanning Report and study each section. Please find attachment sheet of describe planning and resolution of both current and new ISLG of these security scan result.

security-scan-result.xlsx 10.4 KB • Download

Thanks,
Jitesh

May 02, 2019 at 1:43 PM Notified 3 people

Morgan Maguire, CEO

Hi

Jitesh

,

Thanks for the report above. Just to clarify a few items, the report below states "Max Overcome" and "Overcome" in the ISLG Rebuild column. Could you clarify what is meant by these two terms? Does "Overcome" mean the issue is already resolved in the new application, and "Max Overcome" mean the team is working on resolving the issue? Please clarify.

image.png 52.4 KB • Download

Also, for the SQL injection problems, you remark, "Current ISLG major impact of functionality". Does this mean resolving these problems is going to take a significant amount of work to resolve? Also, will resolving these issues have impacts on the performance/functionality of the application?

Thanks,

Morgan

May 02, 2019 at 3:48 PM Notified 3 people

Ryan Knuth, Customer Support Manager

Hi

Jitesh

Thanks very much for going through the document. I have the same questions as

Morgan

.

Thanks!

Ryan

May 02, 2019 at 6:31 PM Notified 3 people

Jitesh Dhuravala

Hi

Morgan

,

Overcome means "succeed in controlling"
Max Overcome means "Max try to controlling"

"Overcome" means it will be resolve in ISLGRebuild and "Max Overcome" means it will max points will be resolve in ISLGRebuild, In new ISLG we are focusing those security issues and max try to overcome.

Does "Overcome" mean the issue is already resolved in the new application, and "Max Overcome" mean the team is working on resolving the issue?

Yes, Morgan we are working in such manor to not facing these security attack in new ISLG.

Does this mean resolving these problems is going to take a significant amount of work to resolve? Also, will resolving these issues have impacts on the performance/functionality of the application?

Morgan, in current ISLG there are need lots of improvement and changes of work flow so it seems like redesign and development to overcome those sql injection in current ISLG. my suggesion is not do changes in current ISLG to resolving those points it will impact major functionality as well.

we will resolve and planning in new ISLG to not reproduce SQL Injection attack.

Let me know your feedback.

Thanks,
Jitesh

May 03, 2019 at 4:43 AM Notified 3 people

Morgan Maguire, CEO

Hi

Jitesh

,

Thank you for the clarification. Ok. I suppose if fixing the issues in the current application will require a significant amount of work, and may have affects on functionality, we'll hold off. However, please ensure all these issues are resolved in the new application.

We'll keep this report handy for reference purposes, and perform another scan as appropriate before launch.

Thanks,

Morgan

May 03, 2019 at 2:34 PM Notified 3 people

Morgan Maguire, CEO

Hi

Ryan

,

A reminder to run the security scan on the non-member pages of ISLG.

Thanks,

Morgan

May 13, 2019 at 11:09 PM Notified 3 people

Ryan Knuth, Customer Support Manager

Hi all,

Please find attached the security scan focused on the non-member side of the site.

Thanks!

Ryan

ZAP Scanning Report.pdf 111 KB • Download

dev-islg-public-May1619.html 118 KB • Download

May 16, 2019 at 3:01 PM Notified 3 people

Morgan Maguire, CEO

See above

Jitesh

.

Morgan

May 23, 2019 at 3:29 PM Notified 3 people

Jitesh Dhuravala

I will look into it and let update you by tommorrow.

Thanks,
Jitesh

May 23, 2019 at 3:31 PM Notified 3 people

Morgan Maguire, CEO

Great. Thanks

Jitesh

.

Morgan

May 23, 2019 at 4:20 PM Notified 3 people

Jitesh Dhuravala

Hi

Morgan

,

I have study security scan report on the non-member pages of ISLG and we are working on it. first we are taking Medium and low category and it will be done in 2-3 days.

High category will take it after complete medium and low Risk Level.

Thanks,
Jitesh

May 24, 2019 at 12:48 PM Notified 3 people

Morgan Maguire, CEO

Ok. Great,

Jitesh

.

Let us know as each issue is resolved.

Morgan

May 24, 2019 at 4:44 PM Notified 3 people

Morgan Maguire, CEO

Hi

Jitesh

,

Could you please provide an update on getting the issues in this to-do resolved? Please provide an itemized update on the high and medium risks alerts in the following report:

ZAP Scanning Report.pdf 111 KB • Download

Thanks,

Morgan

Jun 17, 2019 at 5:23 PM Notified 3 people

Jitesh Dhuravala

Hi

Morgan

,

We have resolved risk level Low category and looking into medium, High risk level impact major changes of development due to parameter passed in URL and some implementation of development structure so we will reduce High category in new approach in ISLG Rebuid.

Thanks,
Jitesh

Jun 18, 2019 at 10:57 AM Notified 3 people

Morgan Maguire, CEO

Hi

Jitesh

,

As we've discussed above, we can leave the security issues concerning the members pages unresolved until the rebuild is complete, but all the issues for the public non-member pages, which are contained in the report above need to be resolved immediately. We can't continue to operate public web pages that could be vulnerable to a high risk attack. How do you suggest we address the issue?

Note that the public non-member pages were only setup last year, so I would assume that we could deal with these more easily than the member pages. If not, we may need to consider migrating all the public pages to a more secure CMS environment.

Morgan

Jun 18, 2019 at 4:52 PM Notified 3 people

Morgan Maguire, CEO

Hello

Jitesh

,

Harsh

and

Ryan

,

To sum up what we discussed earlier today, here is the plan for next steps on this issue:

Jitesh will prepare report summarizing how each issue raised in the most recent security can is being addressed.
Depending on what potential issues are outstanding, we will either run an additional scan on the non-member pages of www.islg; or we will get a security certificate issued on dev.islg, and run an additional scan on dev.islg.

Thanks,

Morgan

Jun 20, 2019 at 4:47 PM Notified 3 people

Jitesh Dhuravala

Hi

Morgan

,

Following report showing how we will addressed issue raised in the recent security scanning report.

image.png 56.2 KB • Download

Yes Morgan, You can either run scan on www.islg or set security certificate on dev.islg. it will be useful to avoid reason which we know of site vulnerability.

Thanks,
Jitesh

Jun 21, 2019 at 12:10 PM Notified 3 people

Ryan Knuth, Customer Support Manager

Great, thanks

Jitesh

.

I'll reach out to Carbon60 to see if they support Let's Encrypt certificates that we can get installed on dev.islg.

Ryan

Jun 21, 2019 at 12:50 PM Notified 3 people

Morgan Maguire, CEO

Great. Thanks

Jitesh

and

Ryan

. Looks like we'll get everything resolved to a satisfied state once we get the certificates installed on dev.islg.

Ryan

, let me know if you need anything on my end to those ordered from Carbon60.

Thanks,

Morgan

Jun 21, 2019 at 4:37 PM Notified 3 people

Morgan Maguire, CEO

Hi

Ryan

,

Have we got a response from Carbon60 on getting the security certificates for dev.islg?

Thanks,

Morgan

Jul 02, 2019 at 3:46 PM Notified 3 people

Ryan Knuth, Customer Support Manager

Hi

Morgan

Oddly nothing yet. I've followed up again.

Ryan

Jul 08, 2019 at 1:06 PM Notified 3 people

Morgan Maguire, CEO

Ok. Thanks

Ryan

.

Please cc me on the email when you send it to Carbon60, so that I can follow-up if necessary.

Morgan

Jul 08, 2019 at 7:25 PM Notified 3 people

Ryan Knuth, Customer Support Manager

Hi

Morgan

They've responded with the following:

After reviewing internally, we can confirm that Let’s Encrypt is supported on this server, and if you would like your developers to install and manage the Let’s Encrypt application you may proceed at any time.
If however you would like any assistance from Carbon60 to install, we can absolutely assist and would engage our Professional Services team to help, which would require a quote and signoff from you before we proceed. If this is the path you’d like to take please let us know and we can initiate this process.

Harsh

Jitesh

do you have experience installing Let's Encrypt certificates?

Thanks!

Ryan

Jul 08, 2019 at 7:41 PM Notified 3 people

Jitesh Dhuravala

Hi

Ryan

,

I have study about Let' Encrypt Installation guideline on website. its seems like there is many dependency needed of network team when we start installation on server. also we have not done same excise previously so it is better to do by them. it might be wrong effect on www.islg live site as both website configured on same server.

Thanks,
Jitesh

Jul 11, 2019 at 7:40 AM Notified 3 people

Ryan Knuth, Customer Support Manager

Ok, thanks

Jitesh

.

Morgan

I'll let you get in touch with Bik to see what the costs would be. It's worth assessing the cost of Carbon60 installing the free Lets Encrypt certificate vs. purchasing a certificate directly from them. It's hard for me to judge whether there would be any cost savings at that point.

Ryan

Jul 11, 2019 at 12:56 PM Notified 3 people

Morgan Maguire, CEO

Ok. Sounds good

Ryan

. However, did we implement this in www.islg? I'd like to confirm that first before I contact Bik.

Morgan

Jul 11, 2019 at 1:18 PM Notified 3 people

Ryan Knuth, Customer Support Manager

No, we had purchased a certificate for www.islg that Carbon60 installed.

Jul 11, 2019 at 1:19 PM Notified 3 people

Morgan Maguire, CEO

Ok. Sounds good. Could you forward me the email correspondence you've had so far with Carbon60 on this issue, and I'll see if Bik can assist in getting this implemented.

Thanks,

Morgan

Jul 11, 2019 at 4:47 PM Notified 3 people

Morgan Maguire, CEO

Ryan

, just following up on this again. Could you please forward me the email correspondence so far with Carbon60 on this issue. I haven't been cc'd so far, I want to ensure I'm in the loop on what has been discussed so far before I contact Bik.

Thanks,

Morgan

Jul 12, 2019 at 5:36 PM Notified 3 people

Ryan Knuth, Customer Support Manager

Hi

Morgan

Sorry about that - I had meant to send it yesterday. I've just forwarded you the email thread.

Thanks!

Ryan

Jul 12, 2019 at 5:38 PM Notified 3 people

Morgan Maguire, CEO

Great. Thanks

Ryan

. I've sent the request off to Carbon60.

Morgan

Jul 12, 2019 at 5:44 PM Notified 3 people

Morgan Maguire, CEO

Hi

Harsh

,

Could you please reactivate the automated emails for dev.islg (I believe they are still disabled to run scans above). We need to create accounts on the development environment, and we can't do so until these automated emails are restored.

Thanks,

Morgan

Jul 17, 2019 at 10:48 PM Notified 3 people

Harsh Parikh, Tech Lead

Hi

Morgan

,

We have reactivated the automated emails on dev.islg.

Jul 18, 2019 at 1:26 PM Notified 3 people

Morgan Maguire, CEO

Great. Thanks

Harsh

. Note that Carbon60 is installing the security certificate on dev.islg. I'll let you know when the work is complete, and then we'll run the final security test.

Morgan

Jul 18, 2019 at 3:08 PM Notified 3 people

Ryan Knuth, Customer Support Manager

Hi

Harsh

,

Could you please suppress the emails again on dev.islg? Now that the cert is installed on dev.islg I will start the security scan of the non-member pages on Monday morning.

Thanks!

Ryan

Jul 26, 2019 at 12:57 PM Notified 3 people

Harsh Parikh, Tech Lead

Hi

Ryan

,

We have suppressed the emails on dev.islg.

Jul 29, 2019 at 8:59 AM Notified 3 people

Ryan Knuth, Customer Support Manager

Thanks

Harsh

!

Ryan

Jul 29, 2019 at 12:59 PM Notified 3 people

Ryan Knuth completed this to-do.

Jul 30, 2019 at 3:49 PM

TOLOGIX - ISLG Maintenance

✔ May 2019 scan - results

Comments & Events